Query Wizard and Query Filter Bar (Devices)
  • 9 minutes to read
  • Print
  • Share
  • Dark
    Light

Query Wizard and Query Filter Bar (Devices)

  • Print
  • Share
  • Dark
    Light

The Axonius Query Wizard lets customers create granular queries to understand how devices and users adhere to their policies.

Working with the Query Wizard

While in the Devices screen, you can click Query Wizard on the top right corner above the Devices table to open the popup dialog that allows you to define multiple filters. Defining filters in the Query Wizard allows you to easily drill down to the assets that match the required search criteria.

Here is an example of using the Query Wizard to show only Windows device assets that have been seen in the last 7 days using filters where the value of the common field OS: Type equals Windows and the value of the common field Last Seen is within the last 7 days.

image.png

Each row in the Query Wizard is a filter expression that consists of the following elements:

  1. AND / OR switch
  2. NOT Flag
  3. Source drop-down
  4. Adapter drop-down
  5. Field drop-down
  6. Operator drop-down
  7. Value field
  8. Bracket controls

1. AND / OR Switch

This switch is only shown on the second and subsequent filter rows. When you have more than one filter defined, this allows you to control whether all filters are required to match, or if just one filter can match.

2. NOT Flag

This flag allows you to negate the filter line, and only match assets that do NOT match the adapter, field, operator, and value specified.


For example:
image.png
It means that Axonius will return all devices EXCEPT the devices where the OS type is Windows (including devices where the OS type is unknown or this field doesn’t apply, and not just devices that their OS type is defined and NOT Windows).

3. Source Drop-Down

This source drop-down contains the following options:

  • Aggregated Data (displayed as ALL)
    • This option lets you query on all assets common fields fetched from any of the adapter connections.
    • This option is selected by default.
  • Complex Field (displayed as OBJ)
    • This option lets you query on assets with a specific complex field that meets the specified criteria.
      • Example: query on all devices that have an installed software that meets the following criteria:
        • Installed Software:Software Name contains 'chrome'.
        • Installed Software:Software Version contains '79'.

image.png

  • Asset Entity (displayed as ENT)
    • This option lets you query on a specific asset entity, meaning, a device or a user entity fetched from a specific adapter connection.
    • This option is useful if assets in your Axonius environment have been correlated by several different asset entities from the same adapter connection, for example: Amazon Web Services (AWS), Microsoft Azure Active Directory (Azure AD), SolarWinds Network Performance Monitor and Tanium.
      • Example 1: query on all devices that were fetched from Microsoft Azure Active Directory (Azure AD) (but not from Microsoft Intune, which is also part of this adapter) and are managed by Azure AD.
      • Example 2: query on all users that were fetched from Amazon Web Services (AWS) with a specific Account Tag and do not have MFA.

image.png

  • Field Comparison (displayed as CMP)
    • This option lets you compare between adapter field values, and only return devices which match the comparison.
    • The following field types are supported: String, Enum, Boolean, Numeric and Date.
    • For String, Enum, Boolean, and Numeric fields - Equals operand is supported (String comparison is case-sensitive)
    • For Date fields - Equals, <, >, <days and >days operands are supported.
    • When comparing date fields, the time is ignored and only the date is compared.
    • The new >days operand lets you query if the first date field is later than the second date field by more than the number of days specified.
    • The new <days operand lets you query if the first date field is sooner than the second date field by more than the number of days specified.
    • Example: query all devices whose last seen by the Amazon Web Services (AWS) adapter is more than 3 days after their last seen by the Microsoft Active Directory (AD) adapter.

image.png

4. Adapter Drop-Down

This drop-down contains a list of all adapters that have fetched data for assets. The adapter that is selected in this drop-down controls the list of fields displayed in the Field drop-down. You can quickly search for adapters using the search bar at the top of this drop-down.

The first entry and default selection in this drop-down is Aggregated with a image.png icon. All of the fields for Aggregated are the collated values from all of the data that has been fetched for all adapters, considered as common fields.

You can control the adapter data sources that are used when evaluating a filter for a common field. By default, all adapters are selected. If you choose to only evaluate the operator and value query data in a cmmon field from a subset.

The adapter source of a Aggregated Data / common field can be specified. If specified, the image.png icon will be replaced by image.png, to indicate that specific sources have been selected. By default, all adapter sources are queried.

image.png

5. Field Drop-Down

This drop-down contains a list of all the fields that have been fetched for a specific adapter. In the case of the Aggregated selection in the Adapter drop-down, this is a list of all fields whose data is collated from all adapters.

  1. Select the common field option (image.png icon, default option) to search any generic field. Common fields are device properties retrieved from multiple adapters.

  2. Click the Adapter drop-down list to select the device property to be queried. Use the search bar to search for a specific field name.

6. Operator drop-down

Once a field is selected, you need to select a comparison function from a drop-down list. For each field type there is a list of possible functions:

  • Enumerated – 'equals' function along with a selection of a values from a list of pre-defined values
  • Text – 'contains', 'equals', 'in', 'starts' and 'ends' functions, all refer to a text value to compare to.
    • When choosing 'in', the text value should be a comma-separated list of values.
    • When choosing 'in', the comma (,) character can be escaped by using double backslash (e.g \\,)
  • Numeric – 'equals', '>' (greater) and '<' (lesser) functions, all refer to a numeric value to compare to.
  • Date – '>' (after), '<' (before), 'last days' and 'next days' functions, all refer to a date expression to compare to.
    When choosing '<' or '>' the value to compare is a chosen calendar date expression. When choosing 'last days' and 'next days' the value to compare to is the relative number of days (integer). When choosing 'last hours' and 'next hours' the value to compare to is the relative number of hours (integer).
  • IP – 'size', 'exists', 'in subnet', 'not in subnet', 'contains', 'equals', 'isIPv4' and 'isIPv6' functions, all refer to an IP address value to compare to.
  • Version - 'contains', 'equals', 'earlier than', 'later than' functions, all refer to a version value to compare to.
NOTE
The 'exists' function can be used to filter the existence of any property value and is available for all field types.
NOTE
A single query expression using the 'in' function can replace multiple query expressions using the 'equals' function with 'or' operands between them.

7. Value Field

Specify the value to be compared by the field and function. Different relevant value options will be enabled according to the field type and the operator/function chosen.

image.png

8. Bracket Controls

When defining multiple expressions with a combination of "OR" and "AND" operands between them, usage of brackets impacts the query definition.

image.png

Expression Indicative Error

When an error occurs for a given expression, an indicative text referring to that error appears in red in the bottom of the Query Wizard. Use it to correct the expression.
For example, missing right bracket:

image.png

When completing a filter expression, the contents of the Devices table is refreshed with the results of your query. When done building the query expression click "Search". The final query expression is displayed in the Query Filter Bar. Click "Clear" to clear all expressions on the wizard, which will also clear the saved query, if used, and will refresh the Devices table and will display all existing devices.

You can always toggle back to the Query Wizard, change and refine the query, and create a multi-filter expression, by adding AND/OR operators between them:

  • To add new expression, click image.png
  • To remove expression, click image.png
  • To reorder the expressions, hover over the expression to use the drag and drop functionality image.png

For each added or removed expression the Devices table results are dynamically updated.

Advanced Querying

Free Text Search in Table

The search bar lets you search free text and filter on devices with or without a predefined 'search by' option. By typing the required search text and pressing Enter, the results filter all entities in the table that contain the given text in any properties.

The available search options are:

  • Free text search - Axonius runs the following search logic on the specified search value:
    • 'Case sensitive exact match' search in any of the selected columns.
    • 'Case insensitive exact match/ start with' search in the following columns:
      • Devices page: Hostname, Last Used Users.
      • Users page: User Name, Email.

image.png

  • Predefined 'search by' option
    • Click the search bar dropdown button or press the down arrow key to select one of the predefined 'search by' options:
      • Host Name - to run 'contains' search on 'Host Name' only.
      • Last Used Users - to run 'contains' search on 'Last Used Users'.
      • IP Address - to run 'contains' search on 'Network Interfaces: IPs'.
      • Installed Software Name - to run 'contains' search on 'Installed Software: Software Name'.
    • Each 'search by' option consists of a different set of columns, that can be personalized and saved as the user's search default view. For more details, see Editing Table Columns.

image.png

image.png


All searches are tracked and stored. Click the search bar dropdown button or press the down arrow key to browse the search History and the recent Saved Queries ran.
image.png

Using a Saved Query as a Filtering Condition in Query Wizard Expressions

You can use a saved query to create complex queries based on pre-defined queries. Only saved queries whose access is not private can be selected.

NOTE
Please note that future changes to the selected Saved Query will not be reflected in the Query Wizard Expression.

image.png

Was this article helpful?